Privacy policy.

Last updated: 16 July 2026

Who we are

CADEM Sports Ltd ("CADEM", "we") operates the CADEM club platform at app.cademsports.com and the CADEM mobile app: software that grassroots sports clubs use to run sessions, bookings, attendance, payments, communications and player development records.

This policy covers the club platform only. Our merchandise store is a separate service with its own privacy policy.

Registered office: [registered office address]. For anything in this policy, contact privacy@cademsports.com.

Our two roles: controller and processor

For most of the data on the platform, the club is in charge and we act on its instructions:

• Club data (we are the processor).Player and member records, attendance, coach development notes, bookings and club communications are entered and managed by clubs and parents. The club is the data controller for this data and CADEM processes it on the club's behalf, under the Data Processing Addendum in our Terms.
• Account and site data (we are the controller). Your sign-in details, your account profile, platform billing and how you use the site (including analytics, if you opt in) are controlled by CADEM.

The data we process

• Account data: your name, email address and sign-in provider (Google, Apple, Facebook or an email link).
• Children's data,entered by clubs and parents: a child's name, date of birth, club and squad memberships, attendance, coach development notes, and photos or video, which are only ever processed with guardian consent (see below).
• Payment data: bookings, amounts and payment status. Card payments are processed by Stripe; we never see or store full card numbers.
• Communications: messages between parents and clubs, announcements, and the email and SMS delivery records needed to send them.
• Technical data: IP address, device and browser information, and cookies as described in the cookies section.

Children's data

CADEM holds records about children because that is what grassroots clubs run on. We designed the platform with the ICO's Age Appropriate Design Code (the Children's Code) in mind:

• Children do not hold accounts. Accounts belong to adults: parents, guardians, coaches and club staff.
• A child's record is only visible to the staff of the club it belongs to and to the child's own guardians. There is no public directory of children.
• Photos and video are off by default. They are only stored and shown for a child when the club has enabled media and the child's guardian has granted consent for that club. If anything is missing, no photo is shown.
• A guardian decides whether one club may see another club's record of their child, and can revoke that sharing at any time.
• We do not advertise to children, profile them, or use their data for anything beyond running the club they attend.

Lawful bases

• Contract: providing the platform to you and processing bookings you make.
• Legitimate interests: keeping the platform secure, preventing abuse and improving the service.
• Consent:analytics cookies (only after you accept them) and children's photos or video (only with guardian consent, recorded per child per club).
• Legal obligation: keeping payment and accounting records the law requires.

Where we act as a processor, the club as controller determines its own lawful basis for the club data it holds.

Sub-processors

We use a small set of service providers to run the platform. Each processes data only to provide its service to us:

• Neon — Postgres database hosting.
• Vercel — application hosting.
• Stripe — payment processing.
• Resend — transactional email.
• Twilio — SMS messages.
• Pusher — real-time messaging.
• PostHog — product analytics, which only runs after you opt in via the cookie banner.
• Cloudflare R2 — private storage for consent-gated photos and video.

How long we keep data

• Account data is kept while your account is active, and deleted within a reasonable period after you close it.
• Club data is kept for as long as the club uses the platform. When a club leaves, its data is deleted or returned under the Data Processing Addendum.
• Payment and accounting records are kept for as long as UK tax and accounting law requires, typically six years.

Your rights

Under UK GDPR you can ask us to:

• give you access to the personal data we hold about you,
• correct it,
• erase it,
• restrict or object to how we use it, and
• provide it in a portable format.

To exercise any of these, email privacy@cademsports.com. Where your request concerns club data we hold on a club's behalf, we will pass it to the club and help it respond. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you are unhappy with how we handle your data.

Cookies

We use two kinds of cookies and similar storage on the platform:

• Essential: the cookie that keeps you signed in. The platform cannot work without it, so it is always on.
• Analytics (optional): PostHog, which helps us understand how the platform is used. Analytics stays off until you choose Accept in the cookie banner. If you choose Decline, no analytics runs.

Your choice is stored in your browser so we do not ask again. To change your mind, clear this site's data in your browser and the banner will reappear.

Changes to this policy

When we change this policy we will update the date at the top, and for significant changes we will tell clubs and account holders directly.

Contact

Privacy and data protection: privacy@cademsports.com. Everything else: see our contact page.